CVE-2013-1840
Full vulnerability record from the local CVENow database.
Description
A flaw was found in OpenStack Glance. Remote authenticated users can exploit this vulnerability by requesting a cached image when the single-tenant Swift or S3 store is in use. This action causes the system to report the location field, which can lead to the disclosure of the operator's backend credentials.
Severity
MEDIUM
CVSS score
6.5
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2013-03-22 21:55:01.487000
Last modified
2026-10-30 19:17:27.123000
View original CVE JSON
{
"id": "CVE-2013-1840",
"sourceIdentifier": "[email protected]",
"published": "2013-03-22T21:55:01.487",
"lastModified": "2026-10-30T19:17:27.123",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in OpenStack Glance. Remote authenticated users can exploit this vulnerability by requesting a cached image when the single-tenant Swift or S3 store is in use. This action causes the system to report the location field, which can lead to the disclosure of the operator's backend credentials."
},
{
"lang": "es",
"value": "La API v1 en OpenStack Vistazo Essex (2012.1), Folsom (2012.2) y Grizzly, al utilizar el 'single-tenant Swift' o la tienda S3, informa el campo de ubicación, lo que permite obtener las credenciales del back-end del operador a usuarios remotos autenticados a través de una solicitud de una imagen almacenada en caché."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Red Hat",
"product": "OpenStack Folsom for RHEL 6",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openstack-glance",
"cpes": [
"cpe:/a:redhat:openstack:2::el6"
],
"versions": [
{
"version": "0:2012.2.3-8.el6ost",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenStack Platform 16.2",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openstack-glance",
"cpes": [
"cpe:/a:redhat:openstack:16.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenStack Platform 17.1",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openstack-glance",
"cpes": [
"cpe:/a:redhat:openstack:17.1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenStack Platform 18.0",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openstack-glance",
"cpes": [
"cpe:/a:redhat:openstack:18.0"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
"baseScore": 3.5,
"accessVector": "NETWORK",
"accessComplexity": "MEDIUM",
"authentication": "SINGLE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"baseSeverity": "LOW",
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-201"
}
]
},
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-200"
}
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openstack:glance:v1:*:*:*:*:*:*:*",
"matchCriteriaId": "3E39288B-D80F-493D-BD2A-6A749EBCE0AB"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:a:openstack:essex:2012.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E5FDB43F-B315-4F68-9D86-B644F2D4DF9A"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:a:openstack:folsom:2012.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E76B76AB-D744-4163-8615-7BA18ABB1347"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:a:amazon:s3_store:-:*:*:*:*:*:*:*",
"matchCriteriaId": "05BC26BF-62C4-47E9-81B1-C968904F1FF2"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:a:openstack:swift:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BE675165-BF5F-4BB3-964F-777CC3DDFF98"
}
]
}
]
}
],
"references": [
{
"url": "http://osvdb.org/91304",
"source": "[email protected]"
},
{
"url": "http://rhn.redhat.com/errata/RHSA-2013-0707.html",
"source": "[email protected]"
},
{
"url": "http://secunia.com/advisories/52565",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "http://www.openwall.com/lists/oss-security/2013/03/14/15",
"source": "[email protected]"
},
{
"url": "http://www.securityfocus.com/bid/58490",
"source": "[email protected]"
},
{
"url": "http://www.ubuntu.com/usn/USN-1764-1",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2013:0707",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2013-1840",
"source": "[email protected]"
},
{
"url": "https://bugs.launchpad.net/glance/+bug/1135541",
"source": "[email protected]"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82878",
"source": "[email protected]"
},
{
"url": "https://review.openstack.org/#/c/24437/",
"source": "[email protected]"
},
{
"url": "https://review.openstack.org/#/c/24438/",
"source": "[email protected]"
},
{
"url": "https://review.openstack.org/#/c/24439/",
"source": "[email protected]"
},
{
"url": "http://osvdb.org/91304",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://rhn.redhat.com/errata/RHSA-2013-0707.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/52565",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
]
},
{
"url": "http://www.openwall.com/lists/oss-security/2013/03/14/15",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/58490",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.ubuntu.com/usn/USN-1764-1",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://bugs.launchpad.net/glance/+bug/1135541",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82878",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://review.openstack.org/#/c/24437/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://review.openstack.org/#/c/24438/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://review.openstack.org/#/c/24439/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
]
}